Project:
Date:
2022-February-09
Vulnerability:
Cross Site Scripting
Affected versions:
<1.0.1
Description:
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail.
The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer custom breadcrumbs" permission.
Solution:
Install the latest version:
- If you use the Custom Breadcrumbs module for Drupal 8.x or 9.x, upgrade to Custom Breadcrumbs 1.0.1
Reported By:
Coordinated By:
- Chris McCafferty of the Drupal Security Team
